litellm/.gitguardian.yaml at main · AtharvaJaiswal005/litellm · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
version: 2

secret:
  # Exclude files and paths by globbing
  ignored_paths:
    - "**/*.whl"
    - "**/*.pyc"
    - "**/__pycache__/**"
    - "**/node_modules/**"
    - "**/dist/**"
    - "**/build/**"
    - "**/.git/**"
    - "**/venv/**"
    - "**/.venv/**"

    # Large data/metadata files that don't need scanning
    - "**/model_prices_and_context_window*.json"
    - "**/*_metadata/*.txt"
    - "**/tokenizers/*.json"
    - "**/tokenizers/*"
    - "miniconda.sh"

    # Build outputs and static assets
    - "litellm/proxy/_experimental/out/**"
    - "ui/litellm-dashboard/public/**"
    - "**/swagger/*.js"
    - "**/*.woff"
    - "**/*.woff2"
    - "**/*.avif"
    - "**/*.webp"

    # Test data files
    - "**/tests/**/data_map.txt"
    - "tests/**/*.txt"

    # Documentation and other non-code files
    - "docs/**"
    - "**/*.md"
    - "**/*.lock"
    - "poetry.lock"
    - "package-lock.json"

  # Ignore security incidents with the SHA256 of the occurrence (false positives)
  ignored_matches:
    # === Current detected false positives (SHA-based) ===

    # gcs_pub_sub_body - folder name, not a password
    - name: GCS pub/sub test folder name
      match: 75f377c456eede69e5f6e47399ccee6016a2a93cc5dd11db09cc5b1359ae569a

    # os.environ/APORIA_API_KEY_1 - environment variable reference
    - name: Environment variable reference APORIA_API_KEY_1
      match: e2ddeb8b88eca97a402559a2be2117764e11c074d86159ef9ad2375dea188094

    # os.environ/APORIA_API_KEY_2 - environment variable reference
    - name: Environment variable reference APORIA_API_KEY_2
      match: 09aa39a29e050b86603aa55138af1ff08fb86a4582aa965c1bd0672e1575e052

    # oidc/circleci_v2/ - test authentication path, not a secret
    - name: OIDC CircleCI test path
      match: feb3475e1f89a65b7b7815ac4ec597e18a9ec1847742ad445c36ca617b536e15

    # text-davinci-003 - OpenAI model identifier, not a secret
    - name: OpenAI model identifier text-davinci-003
      match: c489000cf6c7600cee0eefb80ad0965f82921cfb47ece880930eb7e7635cf1f1

    # Base64 Basic Auth in test_pass_through_endpoints.py - test fixture, not a real secret
    - name: Test Base64 Basic Auth header in pass_through_endpoints test
      match: 61bac0491f395040617df7ef6d06029eac4d92a4457ac784978db80d97be1ae0

    # PostgreSQL password "postgres" in CI configs - standard test database password
    - name: Test PostgreSQL password in CI configurations
      match: 6e0d657eb1f0fbc40cf0b8f3c3873ef627cc9cb7c4108d1c07d979c04bc8a4bb

    # Bearer token in locustfile.py - test/example API key for load testing
    - name: Test Bearer token in locustfile load test
      match: 2a0abc2b0c3c1760a51ffcdf8d6b1d384cef69af740504b1cfa82dd70cdc7ff9

    # Inkeep API key in docusaurus.config.js - public documentation site key
    - name: Inkeep API key in documentation config
      match: c366657791bfb5fc69045ec11d49452f09a0aebbc8648f94e2469b4025e29a75

    # Langfuse credentials in test_completion.py - test credentials for integration test
    - name: Langfuse test credentials in test_completion
      match: c39310f68cc3d3e22f7b298bb6353c4f45759adcc37080d8b7f4e535d3cfd7f4

    # Test password "sk-1234" in e2e test fixtures - test fixture, not a real secret
    - name: Test password in e2e test fixtures
      match: ce32b547202e209ec1dd50107b64be4cfcf2eb15c3b4f8e9dc611ef747af634f

    # === Preventive patterns for test keys (pattern-based) ===

    # Test API keys (124 instances across 45 files)
    - name: Test API keys with sk-test prefix
      match: sk-test-

    # Mock API keys
    - name: Mock API keys with sk-mock prefix
      match: sk-mock-

    # Fake API keys
    - name: Fake API keys with sk-fake prefix
      match: sk-fake-

    # Generic test API key patterns
    - name: Test API key patterns
      match: test-api-key

    - name: Short fake sk keys (1–9 digits only)
      match: \bsk-\d{1,9}\b